Esri ArcGIS Server EUVD-2026-110057

Exploitation requires network access to an ArcGIS Server service on version 12.1 or earlier (Windows or Linux). In the default configuration the attacker must hold privileges to access the targeted service; fully anonymous exploitation is possible ONLY when the service is explicitly configured in the non-default 'public' access configuration. The limiting factors are therefore: (1) reachability of the service, and (2) whether the deployment uses the non-default public access mode - in default deployments a service-access privilege level gates the attack, which reduces realistic exposure below what the raw 9.8 implies. No user interaction is required.

The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) describes a network-reachable, low-complexity SQL injection (CWE-89) with high confidentiality, integrity and availability impact. However, there is a material conflict between the PR:N assignment and the description: the description states the attacker needs 'privileges to access the service,' and anonymous exploitation only applies when the service is deliberately configured in a non-default 'public' access configuration. PR:N therefore holds only for public-configured services; default deployments require service-access privileges, which would lower the practical privilege barrier to authenticated-user level - verify the service's access configuration before treating this as fully unauthenticated. The vuln.today Decision label is act_now, and the issue was reported by the vendor (Esri), which supports treating it as a genuine priority rather than a high-CVSS-but-low-real-risk item. That said, EPSS exploitation probability is not provided, the CVE is not listed in CISA KEV, and no public proof-of-concept or exploit reference is present (the only reference is Esri's own security bulletin), so there is currently no signal of active or imminent exploitation - the urgency here derives from the vendor advisory and the critical technical impact, not from observed in-the-wild activity. Full SSVC inputs (automatable, exploitation status) were not supplied beyond the act_now label.

A remote attacker who can reach an ArcGIS Server service - any authorized service user by default, or an anonymous attacker if the service is configured in the non-default 'public' access mode - submits a crafted request whose input is passed into a backend database query, invoking database-specific functions that should not be permitted. Because attack complexity is low and no user interaction is required, a single malicious request against a reachable service can trigger the injection. No public exploit code or PoC reference is identified at time of analysis.